01Our core principle: your call data stays on your phone
CallVault is built as a replacement for your phone's default dialer app, which means it
needs access to call-related data to function. Your call log, contacts, blocklists, call
flow rules, and Esports Mode session history are stored locally on your device
in CallVault's own database. None of it is uploaded to our servers, shared with third
parties, or used for advertising. The only information that leaves your device is your
subscription status and basic app diagnostics, described in Sections 4 and 6.
02Every permission CallVault requests, and exactly why
Android requires apps to declare every sensitive capability they use. Below is the
complete list of permissions CallVault requests, grouped by what they're for, with the
specific in-app feature each one powers.
Making and managing calls
Permission
Why CallVault uses it
READ_PHONE_STATE
READ_PHONE_NUMBERS
To detect call state (ringing, active, ended) and identify which line a call belongs to, including on dual-SIM devices.
CALL_PHONE
To place outgoing calls when you tap a contact, a call log entry, or dial a number.
ANSWER_PHONE_CALLS
To let you answer an incoming call from CallVault's own call screen.
MANAGE_OWN_CALLS
Required by Android's Telecom framework for any app implementing its own in-call screen and call controls (hold, mute, merge, end call).
PROCESS_OUTGOING_CALLS
Legacy permission (Android 9 and below only) used to detect outgoing calls so Call Flow Rules can apply correctly.
SCREEN_CALLS
Lets CallVault act as your call-screening app — the mechanism behind Block List and Call Flow Rules deciding whether to allow, reject, or silently route an incoming call before it rings.
Call history
Permission
Why CallVault uses it
READ_CALL_LOG
WRITE_CALL_LOG
To display your call history inside the app, write new entries as calls happen, match numbers against your Call Flow Rules, and power the Auto Delete feature that permanently removes call log entries on a schedule you set.
Contacts
Permission
Why CallVault uses it
READ_CONTACTS
WRITE_CONTACTS
To show contact names instead of raw numbers throughout the app, let you save new numbers from your call log, and let Call Flow Rules target "Contacts" or "Favorites" as a caller group.
SMS
Permission
Why CallVault uses it
SEND_SMS
Used only for two opt-in features: (1) an automatic reply text sent to callers while Esports Mode is active, using a message template you write yourself; and (2) the "Reject and SMS" action available in Call Flow Rules. CallVault never requests permission to read your SMS inbox.
Notifications and on-screen display
Permission
Why CallVault uses it
POST_NOTIFICATIONS
To show incoming call, missed call, call waiting, and ongoing call notifications.
USE_FULL_SCREEN_INTENT
To display the full-screen incoming call UI, including when your device is locked.
SYSTEM_ALERT_WINDOW
To show the Esports Mode HUD overlay on top of other apps during gaming sessions, if you enable this feature.
Notification access
(BIND_NOTIFICATION_LISTENER_SERVICE)
A special permission you grant separately in system settings, used only to suppress other apps' notification pop-ups while Esports Mode is active. CallVault does not read, store, or transmit the content of your notifications — it only checks whether to temporarily hide a pop-up.
ACCESS_NOTIFICATION_POLICY
To restore your ring and notification volume to normal after a Call Flow Rule has temporarily shielded them during a call.
Keeping call handling reliable in the background
Permission
Why CallVault uses it
FOREGROUND_SERVICE
FOREGROUND_SERVICE_PHONE_CALL
FOREGROUND_SERVICE_DATA_SYNC
FOREGROUND_SERVICE_SPECIAL_USE
To keep call screening, Call Flow Rules, Esports Mode, and Auto Delete running reliably in the background, and to show the Esports Mode call-alert overlay while you're in another app — as required by modern Android for any app handling live calls.
RECEIVE_BOOT_COMPLETED
To restore these background services automatically after your device restarts, so call screening and rules don't silently stop working until you next open the app.
SCHEDULE_EXACT_ALARM
To trigger scheduled Auto Delete runs and Escape Call's scheduled fake-call feature at the precise time you configure.
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
To ask permission to be exempted from battery optimization, so Android's power management doesn't kill call-handling services mid-call or while a rule is supposed to be active.
WAKE_LOCK
To keep the screen correctly on/off via the proximity sensor during a call, and to keep background services alive while actively processing a call.
Audio and haptics
Permission
Why CallVault uses it
VIBRATE
For ringing vibration patterns, the call-waiting alert, and tap feedback within the in-call screen.
MODIFY_AUDIO_SETTINGS
To switch audio output between earpiece, speaker, and Bluetooth during a call.
Network
Permission
Why CallVault uses it
INTERNET
Used for processing your subscription through Google Play Billing, verifying it with our backend (Firebase) as described in Section 4, and the crash reporting and usage analytics described in Section 6. CallVault does not transmit your call log, contacts, or SMS content over the network.
03Auto-delete and the data you control
Auto Delete lets you configure automatic, permanent deletion of call log entries on a
schedule you choose, processed entirely on your device. You can also manually clear your
call history, blocklist, and Esports session history at any time from the app's settings.
Uninstalling CallVault removes all locally stored app data from your device, per standard
Android behavior.
04Information used for your subscription
CallVault offers optional premium features through a subscription processed via Google
Play's billing system. To keep your premium status accurate and tamper-resistant, we use
Firebase (a Google service) for exactly this purpose:
- Firebase Authentication — creates an anonymous account identifier for your installation so your subscription can be associated with your device.
- Cloud Firestore — stores your subscription status: which plan you're on, whether it's currently active, which features it unlocks, when it expires, and a purchase reference token issued by Google Play (used to re-verify your subscription — this token is not your card or UPI details).
- Firebase Functions — runs on our servers to verify, directly with Google's Play Developer API, that a purchase is genuine before activating premium features, and automatically re-checks every active subscription roughly every 12 hours so cancellations and refunds are reflected promptly.
We do not transmit your call log, contacts, SMS content, or any call metadata to Firebase
or any other server. The data sent to Firebase for subscription purposes is limited to the
information above. Payment details (card numbers, UPI IDs, etc.) are handled entirely by
Google Play Billing — Codinja Nexus Private Limited never sees or stores your payment
information.
05What we don't do
- We do not sell your data to anyone, under any circumstances.
- We do not use your call log, contacts, or SMS data for advertising or analytics.
- We do not share your call log, contacts, or SMS data with third parties.
- We do not use crash or usage analytics data for advertising, and CallVault does not use the Android Advertising ID. This data is never combined with your call log, contacts, or SMS content — see Section 6 for exactly what's collected and why.
06Analytics, crash reporting & service providers
We rely on a small number of infrastructure providers to operate CallVault, keep it
stable, and understand how it's used. They process data only as needed to provide their
service to us, under their own privacy and security commitments, and are not independent
third parties we share your data with for their own purposes:
- Firebase Crashlytics — for crash and diagnostic reporting. When CallVault crashes, this collects your device model, OS version, app version, the crash stack trace, and internal diagnostic flags describing which feature was active at the time (for example, whether Esports Mode or a Call Flow Rule was on). It does not collect the content of your calls, contacts, or messages.
- Google Analytics for Firebase — for usage analytics, so we can see how the app is used and where it can be improved. This automatically collects app opens, session length, which screens you visit and how you move between them, device model, OS version, language/region, and an approximate location derived from your IP address (not precise GPS). It does not collect the content of your calls, contacts, or messages, and is not used for advertising.
- Google Firebase (Authentication, Firestore, Functions) — for subscription/entitlement management, as described in Section 4.
- Google Play Billing — for processing subscription payments. See Google's Privacy Policy.
Crashlytics and Analytics both use a per-install identifier to group this data by device.
This identifier is not linked to your name, email, or any other personal identifier we
collect — we don't collect a name or email from you anywhere in the app. See
Firebase's privacy and security documentation
for how Google handles this data on our behalf.
07Default phone app status and why CallVault asks first
In line with Google Play policy, CallVault prompts you to set it as your device's default
Phone app before requesting Call Log permissions, and only uses its SMS-sending
capability while registered as your default Phone app for the features described in
Section 2. If you remove CallVault as your default Phone app, it stops using these
permissions for any new activity.
08Children's privacy
CallVault is not directed at children under 13 (or the relevant minimum age in your
country), and we do not knowingly collect personal information from children. If you
believe a child has provided us with personal information, please contact us using the
details below and we will take appropriate action.
09Data retention
Call log, contacts, blocklist, rules, and session data remain on your device until you
delete them (manually or via Auto Delete) or uninstall the app. Subscription/entitlement
data in Firebase is retained for as long as your account is active and for a reasonable
period afterward to handle billing disputes, restores, and legal/tax requirements, after
which it is deleted or anonymized. Crash and usage analytics data is retained by Google
Firebase per its standard retention periods before automatic deletion or anonymization —
see Firebase's own documentation linked in Section 6 for current specifics.
10Your choices and rights
- You can review and revoke any Android permission for CallVault at any time via your device's Settings → Apps → CallVault → Permissions.
- You can delete locally stored data (call log, contacts cache, rules, sessions) from within the app, or by uninstalling CallVault.
- You can permanently delete your subscription/account data held with us at any time using "Delete My Data" in the app's Settings → About screen, or by contacting us at the email below. See our Data Deletion Request page for full step-by-step instructions. This does not cancel an active Google Play subscription, which is managed through Google Play directly.
- If you are in the European Economic Area, UK, or a jurisdiction with similar data protection laws, you may have additional rights (access, correction, portability, objection) under applicable law — contact us to exercise them.
- If you are in India, your data is handled in line with the Digital Personal Data Protection Act, 2023, to the extent applicable to the limited account/subscription and diagnostic data described above.
Quickest path: open CallVault → Settings → About → "Delete My Data." It's instant, and it's the same action described in full on the Data Deletion Request page.
11Security
We use industry-standard measures to protect the limited data CallVault does transmit,
including encrypted connections (HTTPS/TLS) to Firebase and Google Play services, and
application-level safeguards against tampering with subscription/purchase verification.
No method of transmission or storage is 100% secure, but we work to protect your
information using commercially reasonable means.
12Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect new features
or changes in legal requirements. We will update the "Last updated" date at the top of
this page when we do, and material changes will be highlighted in the app's update notes
where appropriate.
13Contact us
If you have questions about this Privacy Policy or how CallVault handles your data, contact us at: